summaryrefslogtreecommitdiff
path: root/sound/core/control.c
diff options
context:
space:
mode:
authorTakashi Sakamoto <o-takashi@sakamocchi.jp>2016-07-07 21:57:10 +0900
committerTakashi Iwai <tiwai@suse.de>2016-07-07 15:47:50 +0200
commit860c1994a70a0d2ab6f87fb7e72e722a8fb2c64c (patch)
treedcd1244adeac93bdd572b790d5945466df84fc58 /sound/core/control.c
parentb268c34e5ee92a4cc3099b0caaf26e6bfbdf0f18 (diff)
ALSA: control: add dimension validator for userspace elements
The 'dimen' field in struct snd_ctl_elem_info is used to compose all of members in the element as multi-dimensional matrix. The field has four members. Each member represents the width in each dimension level by element member unit. For example, if the members consist of typical two dimensional matrix, the dimen[0] represents the number of rows and dimen[1] represents the number of columns (or vise-versa). The total members in the matrix should be exactly the same as the number of members in the element, while current implementation has no validator of this information. In a view of userspace applications, the information must be valid so that it cannot cause any bugs such as buffer-over-run. This commit adds a validator of dimension information for userspace applications which add new element sets. When they add the element sets with wrong dimension information, they receive -EINVAL. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/control.c')
-rw-r--r--sound/core/control.c32
1 files changed, 32 insertions, 0 deletions
diff --git a/sound/core/control.c b/sound/core/control.c
index a85d45595d02..9ff081cd03f4 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -805,6 +805,36 @@ static int snd_ctl_elem_list(struct snd_card *card,
return 0;
}
+static bool validate_element_member_dimension(struct snd_ctl_elem_info *info)
+{
+ unsigned int members;
+ unsigned int i;
+
+ if (info->dimen.d[0] == 0)
+ return true;
+
+ members = 1;
+ for (i = 0; i < ARRAY_SIZE(info->dimen.d); ++i) {
+ if (info->dimen.d[i] == 0)
+ break;
+ members *= info->dimen.d[i];
+
+ /*
+ * info->count should be validated in advance, to guarantee
+ * calculation soundness.
+ */
+ if (members > info->count)
+ return false;
+ }
+
+ for (++i; i < ARRAY_SIZE(info->dimen.d); ++i) {
+ if (info->dimen.d[i] > 0)
+ return false;
+ }
+
+ return members == info->count;
+}
+
static int snd_ctl_elem_info(struct snd_ctl_file *ctl,
struct snd_ctl_elem_info *info)
{
@@ -1272,6 +1302,8 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
if (info->count < 1 ||
info->count > max_value_counts[info->type])
return -EINVAL;
+ if (!validate_element_member_dimension(info))
+ return -EINVAL;
private_size = value_sizes[info->type] * info->count;
/*